CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- apache software foundation iotdbApache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver7.5 High
- nesquena hermes-webuiHermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API9.3 Critical
- arikusi deepseek-mcp-server@arikusi/deepseek-mcp-server Missing Authentication on Self-Hosted HTTP MCP Endpoint5.3 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +1 more +3 morePAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)4.5 Medium
- mockoonMockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft8.8 High
- superior court of california, county of los angeles hearing reminder serviceSuperior Court of California Hearing Reminder Service unauthenticated information disclosure6.9 Medium
- ruvnet rufloRuflo: Unauthenticated RCE in MCP bridge default docker-compose deployment10.0 Critical
- mettle sendportalmettle sendportal APIv1 Webhooks mailjet missing authentication6.9 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)3.1 Low
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreMissing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.06.9 Medium
- bishopfox joroJoro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE9.6 Critical
- web-infra-dev midsceneMidscene Bridge Server - Session Hijack via Unauthenticated WebSocket7.6 High
- berriai litellmLiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback8.8 High
- trustyai-explainability trustyai-service-operator, red hat openshift ai (rhoai) +1 moreTrustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled6.3 Medium
- trustyai trustyai-service-operator, red hat openshift ai (rhoai) +1 moreTrustyai-service-operator: trustyai service operator: unauthenticated access to ai guardrails and orchestrator apis6.3 Medium
- dgraph-io dgraphDgraph Alpha group stores can be replaced via unauthenticated external snapshot import9.1 Critical
ha-mcpPyPIha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path6.5 Medium- mem0mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints9.3 Critical
- mem0mem0 - Unauthenticated Config API Exposure and SSRF via ollama_base_url9.2 Critical
- oraios serenaSerena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE8.3 High
- topoteretes cogneeCognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings9.3 Critical
- better-auth, better-auth better auth +1 moreBetter Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins9.1 Critical
- No product listedAn issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the...7.5 High
- fossbillingFOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint6.9 Medium
- decolua 9router9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints8.7 High
- decolua 9router9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats9.3 Critical
- decolua 9router9Router 0.4.41 - Unauthenticated API Exposure via /api/providers9.3 Critical
- coollabsio coolifyCoolify unauthenticated feedback endpoint allows Discord webhook abuse6.5 Medium
- fossbillingFOSSBilling missing authorization in guest Invoice API endpoints7.7 High
- fossbillingFOSSBilling has an unauthenticated payment bypass via IPN callback forgery9.2 Critical
- flytohub flyto-coreFlyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`8.4 High
- apache camel, apache software foundation camel keycloak +1 moreApache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null…9.8 Critical
- zhayujie chatgpt-on-wechat cowagentzhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify_server missing authentication6.9 Medium
- jairiidriss restaurant-website-php-mysqljairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authentication6.9 Medium
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level au…8.8 High
- dragonflyoss dragonflyDragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth2.9 Low
- doobidoo mcp-memory-servicemcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete9.8 Critical
- tr7 cyber defense inc. waf-aspImproper Access Control in TR7's WAF-ASP9.8 Critical
- geovision inc. geowebplayerGeoVision GeoWebPlayer 1.1.1.0 Websocket Server function vulnerability8.8 High
- surrealdbSurrealDB before 3.1.0 Session Hijacking via /rpc sessions8.7 High
- hyland pacsgear, pacsgear mediawriter +1 morePACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service9.3 Critical
- hyland pacsgear, pacsgear pacs scan +1 morePACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service9.3 Critical
- cap-go capgoCapgo - Account Deletion Without Password Confirmation7.0 High
- presentonPresenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint6.9 Medium
- jeecgboot jimureportJimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export8.7 High
- suse rancherUnauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook7.0 High
- advantech hospital quering managementAdvantech｜Hospital Quering Management - Missing Authentication9.3 Critical
- delta electronics dvp-12seDVP-12SE Missing Authentication and Unauthorized Write access Vulnerability9.3 Critical
- gorse-io gorseGorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints9.3 Critical
- feehi cmsFeehi CMS REST API Endpoint articles missing authentication6.9 Medium
- Show moreLoading…